Buffer overflow in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10, 9.5 before FP7, and 9.7 before FP3 on Linux, UNIX, and Windows allows remote attackers to execute arbitrary code via unspecified vectors.

Versions of IBM DB2 9.7 earlier than Fix Pack 3 are potentially affected by multiple vulnerabilities :

 - When privileges on a database object are revoked from PUBLIC, the dependent functions are not marked INVALID.  As a result, users with execute privilege on the function are still able to call it successfully. (IC68015)
 - If a compound SQL (compiled) statement has been issued by a user that is properly authorized, this is cached in the dynamic SQL cache.  Once cached, this same query can be executed by an user if that user has the proper authority. (IC70406)
 - Multiple buffer overflow vulnerabilities exist in the DB2 Administrative Server (DAS). (IC70539, IC72029)

Versions of IBM DB2 9.5 earlier than Fix Pack 7 are potentially affected by multiple vulnerabilities :

  - A buffer overflow vulnerability exists in the DB2 Administrative Service (DAS). (IC72028)
 - It is possible to update statistics for tables without appropriate privileges. (IC71413)
 - It is possible for a user to execute a non-DDL statement after role memebership has been revoked from its group. (IC71263)

According to its version, the installation of IBM DB2 9.5 running on the remote host is prior Fix Pack 7. It is, therefore, affected by the following vulnerabilities :

  - The 'db2dasrrm' component included with such versions     fails to perform sufficient bounds checks on user-     supplied input, which an attacker could leverage to     overflow the buffer, potentially resulting in arbitrary     code execution on the remote system. (IC72028)

  - An unspecified error in the Relational Data Services     component can be exploited to update statistics for     tables without the appropriate privileges. (IC71413)

  - An error in the Relational Data Services component may     grant users privileges to execute non-DDL statements     after role membership has been revoked from its group.
    (IC71263)

According to its version, the installation of IBM DB2 9.1 running on the remote host is prior to Fix Pack 10. It is, therefore, affected by one or more of the following issues :

  - It is possible to execute non-DDL statements even after     an user's DBADM authority has been revoked. (IC66811)

  - Multiple vulnerabilities in 'db2dasrrm' component could     allow arbitrary code execution. (IC71203)/(IC69986)

According to its version, the installation of IBM DB2 9.7 running on the remote host is prior Fix Pack 3. It is, therefore, affected by one or more of the following issues :

  - When privileges on a database object are revoked from     PUBLIC, the dependent functions are not marked INVALID.
    As a result, users with execute privilege on the     function are still able to call it successfully.
    (IC68015)

  - If a compound SQL (compiled) statement has been issued     by a user that is properly authorized, this is cached in     the dynamic SQL cache.  Once cached, this same query can     be executed by any user if that user has the proper     authority. (IC70406)

  - Multiple vulnerabilities in 'db2dasrrm' component could     allow arbitrary code execution. (IC70539 / IC72029)

Versions of IBM DB2 9.1 earlier than Fix Pack 10 are potentially affected by multiple vulnerabilities :

  - Multiple buffer overflow vulnerabilities exist in the DB2 Administrative Service (DAS) which could lead to a denial-of-service, or the execution of arbitrary code. (IC69986, IC71203)
 - Users continue to have privilege to execute a non-DDL statement after their DBADM authority has been revoked. (IC66811)

ID	Name	Product	Family	Severity
5751	IBM DB2 9.7 < 9.7 Fix Pack 3 Multiple Vulnerabilities	Nessus Network Monitor	Database	critical
5750	IBM DB2 9.5 < 9.5 Fix Pack 7 Multiple Vulnerabilities	Nessus Network Monitor	Database	critical
51841	IBM DB2 9.5 < Fix Pack 7 Multiple Vulnerabilities	Nessus	Databases	critical
51840	IBM DB2 9.1 < Fix Pack 10 Multiple Vulnerabilities	Nessus	Databases	critical
50451	IBM DB2 9.7 < Fix Pack 3 Multiple Vulnerabilities	Nessus	Databases	medium
5749	IBM DB2 9.1 < 9.1 Fix Pack 10 Multiple Vulnerabilities	Nessus Network Monitor	Database	critical

Detections

Analytics

CVE-2011-0731

critical

Tenable Plugins

critical

critical

critical

critical

medium

critical